Home

Forums

Stories

Knowledge Base

Business Community > Gateways > Wireless client reappears as wired client after applying MAC address filtering

< Gateways

Wireless client reappears as wired client after applying MAC address filtering

NicholasKB

a week ago

Posts: 2

Helpful: 0

Solutions: 0

Stories: 0

Registered: 2024-10-07

Wireless client reappears as wired client after applying MAC address filtering

a week ago

Model: FR365

Hardware Version: V1

Firmware Version: 1.0.4 Build 20240319 Rel.02617(5553)

I'm using a Festa FR365 WiFi Gateway and a FS318GP Switch. I have several VLANs set up and a WLAN associated with VLAN 10.

On the clients tab of the Festa Controller, I noticed an unkown wireless client associated with that WLAN with no IP address assigned to it. Based on the OUI of 00:1c:c2 I believe it may be a Dreo brand oscellating fan, probably belonging to my downstairs tenants but I'm not sure.

Since I couldn't identify it I enabled MAC filtering on the WLAN to deny that specific MAC address. But then it reappears as a wired client on Port 1 of my switch, still without an IP but now associated with the LAN with that same VLAN 10 ... But port 1 on the switch is the port the gateway is plugged into! This unknown device is defintely not plugged into any phsyical ports on my switch or gateway. I'm pretty new to networking and am trying to understand what might be going on.

Prior to enabling MAC address filtering I had also simply attempted to use the reconnect button to see if that would cause it to rejoin the network and maybe get a new DHCP lease. Strangely, I notice that when it first reappears it does so as a wired client on the switch (just like it does when MAC address filtering is applied). But only for a moment, it then switches back to being displayed as a wireless client on that WLAN (again, no IP address is assigned at any point).

I used kismet to sniff wifi packets during that "reconnect" process and can see it being deauthed from the WLAN and attempting to reauthenticate, but it looks like it never completes the EAPOL handshake -- I see steps 1 and 2 but not 3 and 4. Althought it is possible I'm missing packets.

2 Reply

Clive_A

a week ago

Posts: 5981

Helpful: 2947

Solutions: 1375

Stories: 0

Registered: 2023-06-09

Re:Wireless client reappears as wired client after applying MAC address filtering

a week ago

Hi @NicholasKB

Thanks for posting in our business forum.

NicholasKB wrote

I'm using a Festa FR365 WiFi Gateway and a FS318GP Switch. I have several VLANs set up and a WLAN associated with VLAN 10.

On the clients tab of the Festa Controller, I noticed an unkown wireless client associated with that WLAN with no IP address assigned to it. Based on the OUI of 00:1c:c2 I believe it may be a Dreo brand oscellating fan, probably belonging to my downstairs tenants but I'm not sure.

Since I couldn't identify it I enabled MAC filtering on the WLAN to deny that specific MAC address. But then it reappears as a wired client on Port 1 of my switch, still without an IP but now associated with the LAN with that same VLAN 10 ... But port 1 on the switch is the port the gateway is plugged into! This unknown device is defintely not plugged into any phsyical ports on my switch or gateway. I'm pretty new to networking and am trying to understand what might be going on.

What kind of AP do you use?

If it is displayed as a wired client, it is incorrect of course, in your case. But this happens if the network devices are not the same brand. At least we have received the topology appears to be incorrect when you use third-party networking gears.

Troubleshooting Topology in Controller Is Not Recognized Properly

If you can diagnose that the client is an IoT, it could be the connection signal is bad and it may not sync to the controller timely. This also happens to the system. When you reconnect it, it may still offer the same IP address as the ARP has not expired in the system.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.

NicholasKB

LV1

a week ago

Posts: 2

Helpful: 0

Solutions: 0

Stories: 0

Registered: 2024-10-07

Re:Wireless client reappears as wired client after applying MAC address filtering

a week ago

@Clive_A I'm not using a standalone AP, just the built in radios on the FR365 gateway.

I also noticed that it has now dissapeared from the wired clients list -- so it seems that it's appearence after enabling MAC address filtering on the WLAN was only temporary (similar to how it would temporarily appeare as wired after forcing it to reconnected).

I'm fairly confident I've identified the device and it belongs to the tenants who rent my basement, as such it shouldn't have the credentials for the WLAN, which I have not shared with them. And again, based on the packet captures I'm seeing it is not actually authenticating to the network, it is trying to but it doesn't appear to ever succeed. I'm going to see if I can collect more pcaps to confirm this.

>> When you reconnect it, it may still offer the same IP address as the ARP has not expired in the system.

I don't think it has ever been assigned an IP address, the IP address has always appeared as null in the clients table. I'm not sure if it's possible to view DHCP logs from the Gateway so I might try setting up a custom DHCP server to verify this.

My biggest conern is if this device hasn't ever successfully authenticated to the WLAN then why is the controller thinking it is a client of any kind, much less a wired one.

Wireless client reappears as wired client after applying MAC address filtering

Wireless client reappears as wired client after applying MAC address filtering

Information

Voters 0

Tags